CVE-2020-7730: Command Injection in bestzip
Summary
CVE-2020-7730: Command injection in bestzip. Affects bestzip versions < 2.1.7. Fixed in 2.1.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
bestzip is an npm package used for creating zip archives. It provides a simple and convenient way to compress files and directories. However, versions prior to 2.1.7 are vulnerable to a Command Injection vulnerability. This vulnerability allows an attacker to execute arbitrary commands by injecting malicious input through the 'options' parameter.
Vulnerability Detail
The Command Injection vulnerability in bestzip arises from insufficient input validation. An attacker can exploit this vulnerability by crafting a specially crafted input that includes malicious commands. When the vulnerable code processes this input, the injected commands are executed with the privileges of the user running the application. This can lead to various security risks, including remote code execution, unauthorized access, and data manipulation.
How To Fix
Latest published version: 4.0.3 as of 23 Oct 2026
npm install bestzip@4.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.7
This is the first release that contains the fix.
npm install bestzip@2.1.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization manually before passing user input to the 'options' parameter. This can involve using regular expressions or other techniques to restrict the input to expected values and prevent the execution of arbitrary commands. However, applying the official fix by upgrading to the latest version is strongly recommended.
Conclusion
The Command Injection vulnerability in bestzip can have severe consequences, including remote code execution and unauthorized access. It is crucial to upgrade to version 2.1.7 or later to mitigate this vulnerability. Developers should also implement proper input validation and sanitization practices to prevent similar vulnerabilities in their applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for bestzip →
FAQ
bestzip is an npm package used for creating zip archives. It simplifies the process of compressing files and directories into a single zip file.
Command Injection is a security vulnerability that allows an attacker to execute arbitrary commands on a target system. It occurs when user input is not properly validated and is directly passed to a command execution function.
The Command Injection vulnerability in bestzip can lead to remote code execution, unauthorized access to sensitive data, and manipulation of files and directories on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert analyzes your package-lock.json file and provides real-time alerts for open-source vulnerabilities.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for bestzip.
